Merge branch 'ipv6-fix-error-path-of-inet6_init'

Sabrina Dubroca says:

====================
ipv6: fix error path of inet6_init()

The error path of inet6_init() can trigger multiple kernel panics,
mostly due to wrong ordering of cleanups. This series fixes those
issues.
====================

Reviewed-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

2 files changed, 9 insertions, 5 deletions

diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 24431e578310..60c928894a78 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -324,6 +324,10 @@ void rtnl_unregister_all(int protocol)
 
         rtnl_lock();
         tab = rtnl_msg_handlers[protocol];
+        if (!tab) {
+                rtnl_unlock();
+                return;
+        }
         RCU_INIT_POINTER(rtnl_msg_handlers[protocol], NULL);
         for (msgindex = 0; msgindex < RTM_NR_MSGTYPES; msgindex++) {
                 link = tab[msgindex];
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 673bba31eb18..9a4261e50272 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -938,14 +938,14 @@ static int __init inet6_init(void)
 
         err = proto_register(&pingv6_prot, 1);
         if (err)
-                goto out_unregister_ping_proto;
+                goto out_unregister_raw_proto;
 
         /* We MUST register RAW sockets before we create the ICMP6,
          * IGMP6, or NDISC control sockets.
          */
         err = rawv6_init();
         if (err)
-                goto out_unregister_raw_proto;
+                goto out_unregister_ping_proto;
 
         /* Register the family here so that the init calls below will
          * be able to create sockets. (?? is this dangerous ??)
@@ -1113,11 +1113,11 @@ netfilter_fail:
 igmp_fail:
         ndisc_cleanup();
 ndisc_fail:
-        ip6_mr_cleanup();
+        icmpv6_cleanup();
 icmp_fail:
-        unregister_pernet_subsys(&inet6_net_ops);
+        ip6_mr_cleanup();
 ipmr_fail:
-        icmpv6_cleanup();
+        unregister_pernet_subsys(&inet6_net_ops);
 register_pernet_fail:
         sock_unregister(PF_INET6);
         rtnl_unregister_all(PF_INET6);